Most companies use computers to manage business and financial records. Large databases and various programs are used to keep track of all the information required for companies to do business. In the last decade the information that is stored as part of the databases has become accessible from the Internet and Intranet through Web-based applications. These applications dynamically generate a series of Web documents in a standard format supported by common browsers. Web-based applications are built using three-tiers: browser client, middle-tier application server and database server. The Web browser sends requests to the middle tier. The middle-tier services the request after accessing the database server with queries and updates.
An end user accesses a database through an application that is deployed on a middle tier. When the end user accesses the database through the application, the end user is authenticated by the application or middle tier service like SSO. Authentication credentials may include a username, password, SSL certificate, Kerberos ticket, or any other credentials that may be used to validate the identity of the end user. The application connects to the database server as a highly privileged application user acting on behalf of the end user, regardless of whether the end user is highly privileged or lowly privileged. When connecting as a highly privileged application user, the application establishes a session for the highly privileged application user. In one technique, the application may receive a query from a lowly privileged end user, query the database server in a session created for the highly privileged application user, receive a set of results from the database server that includes highly privileged data and lowly privileged data, and remove the highly privileged data from the results before sending the results to the end user. In this technique, the identity of the end user is unknown to the database, and security is enforced only in the application that is deployed on the middle tier.